fix: block .bak-* files from static serving and gitignore them

a35761783c5c9e3c1297ee6796522146fc77ce41 · 2026-05-30 21:26:59 -0700 · Steve Abrams

The guard middleware regex \.bak(\.|$) and .gitignore patterns *.bak / *.bak.*
both missed filenames like index.html.bak-20260526152130 (hyphen-separated timestamp).
- Extend middleware regex to \.bak(\.|[-]|$) to also match .bak-TIMESTAMP
- Add *.bak-* to .gitignore
- Remove the leaked public/index.html.bak-20260526152130 file

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit a35761783c5c9e3c1297ee6796522146fc77ce41
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat May 30 21:26:59 2026 -0700

    fix: block .bak-* files from static serving and gitignore them
    
    The guard middleware regex \.bak(\.|$) and .gitignore patterns *.bak / *.bak.*
    both missed filenames like index.html.bak-20260526152130 (hyphen-separated timestamp).
    - Extend middleware regex to \.bak(\.|[-]|$) to also match .bak-TIMESTAMP
    - Add *.bak-* to .gitignore
    - Remove the leaked public/index.html.bak-20260526152130 file
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitignore | 1 +
 server.js  | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 1140724..dd86897 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,3 +12,4 @@ build/
 *.bak
 *.bak.*
 *.pre-*
+*.bak-*
diff --git a/server.js b/server.js
index 00a945a..407a6b7 100644
--- a/server.js
+++ b/server.js
@@ -150,9 +150,9 @@ try {
 }
 require("./_universal-contact")(app, cfg.contact);
 require("./_universal-auth")(app, cfg.auth);
-// Guard: never serve editor snapshot files (.bak / .bak.* / .pre-*) from static root.
+// Guard: never serve editor snapshot files (.bak / .bak.* / .bak-* / .pre-*) from static root.
 app.use((req, res, next) => {
-  if (/\.bak(\.|$)|\.pre-/i.test(req.path)) return res.status(404).send('Not found');
+  if (/\.bak(\.|[-]|$)|\.pre-/i.test(req.path)) return res.status(404).send('Not found');
   next();
 });
 app.use(express.static(path.join(__dirname, 'public')));

← 01df1cb feat(fleet): theme1/theme2 query-param-gated toggle on catal · back to Restorationwallpaper · Remove Big Red widget — never UX-worked, collided with Help bc146df →